SSLyze — Install, Use, Optimise (2026)

Fast TLS configuration scanner — checks ciphers, protocols, certificate chain, OCSP stapling, vulnerabilities (Heartbleed, ROBOT, etc.).

Installation

Pick the install method that matches your stack. The Docker option is the cleanest for one-off scans where you don’t want to pollute your workstation.

pipx

pipx install sslyze

Linux (apt)

sudo apt install sslyze

Docker

docker run --rm nablac0d3/sslyze --regular target.com:443

Core commands

The handful of invocations you’ll actually run on 90% of engagements:

Default audit

sslyze target.com

Specific port

sslyze target.com:8443

Mozilla intermediate config check

sslyze target.com --mozilla_config=intermediate

JSON output

sslyze target.com --json_out=report.json

Multiple targets

sslyze target1.com target2.com --regular

Performance optimisation

What separates a junior who runs the default invocation from a practitioner who knows the knobs:

• Default scan: ~10-30 sec per host.
• --regular covers protocols, ciphers, certs, vulnerabilities — comprehensive.
• --slow_connection for high-latency or rate-limited targets.
• JSON output is verbose but parses cleanly into compliance reports.

Common pitfalls

Real failure modes that bite people on engagements. Most are recoverable; a few are reputation-damaging.

• Doesn’t test all attacks (e.g., DROWN requires special probing). Cross-check with testssl.sh.
• Some vulnerability checks require specific server cooperation (OCSP). Failures may indicate config issues, not vulnerabilities.

Modern alternatives in 2026

The ecosystem moves fast. These are tools you should at least be aware of:

• testssl.sh — bash-based, more checks, slower.
• nmap –script ssl-* — built into Nmap.
• SSL Labs server test — comprehensive, web-only.

India context and engagement notes

For Indian PCI-DSS / RBI compliance: SSLyze’s output is auditor-friendly. Pair with testssl.sh for second-opinion. Required reading: PCI-DSS v4.0 mandates TLS 1.2+ — SSLyze’s “Mozilla intermediate” config is roughly equivalent.

⚖️ Legal: Use only on systems you own or have explicit written authorisation to test. In India, unauthorised access is punishable under Section 66 of the IT Act, 2000 (up to 3 years imprisonment + fine). Pair every engagement with a signed Statement of Work or Rules of Engagement before running anything from this page.